Put Pince on watch in two minutes

• Linux · systemd
• Rust 1.75+ to build
• root to install

Build#

Gabier is not on crates.io yet, so you build it from the repository. One release profile, one static-ish binary, no runtime dependency.

$ git clone https://github.com/Flottille/gabier
$ cd gabier
$ cargo build --release

Install#

install.sh does the whole job: it creates a dedicated gabier service account with no shell and no home, installs the binary and the hardened unit, drops an example config and enables the service at boot.

$ sudo ./install.sh
# or, with a binary built elsewhere:
$ sudo ./install.sh /tmp/gabier

It lays down:

An existing config.toml is never overwritten, so re-running the script is how you upgrade.

Configure#

Open the config and paste at least one webhook:

$ sudo nano /etc/gabier/config.toml

A minimal config is three lines plus a destination:

[server]
name = "vps-prod-1"

[discord]
webhook_url = "https://discord.com/api/webhooks/…"

Every key is documented in the configuration reference.

Verify, then start#

check validates the config and actually reaches the webhook, without posting anything to your channel. test posts one real message.

$ sudo -u gabier gabier check --config /etc/gabier/config.toml
config    /etc/gabier/config.toml
serveur   vps-prod-1
source    journald (ssh, sshd)
évènements accepted=true failed=true invalid_user=true closed=false
anti-spam 1 échec(s) par IP, puis résumé toutes les 300s
geoip     false
discord   https://discord.com/api/webhooks/123/abcd…
          joignable

Tout est prêt.
$ sudo -u gabier gabier test --config /etc/gabier/config.toml
$ sudo systemctl start gabier
$ sudo journalctl -u gabier -f

What to read next#

• Configuration — every key, its default and what it changes.
• Throttling — the burst logic that keeps a port-22 scan out of your channel.
• CLI — the four subcommands, --dry-run and replay.
• Events — the sshd lines Gabier recognises.
• Discord and Slack — getting a webhook from each.